deps(go): bump module github.com/moby/buildkit to v0.34.0 - #10908

buildkit 0.34.0

Welcome to the v0.34.0 release of buildkit!



Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

### Contributors

* Tõnis Tiigi
* CrazyMax
* Sebastiaan van Stijn
* Akihiro Suda
* Ernestas Lukoševičius
* Alexandre Rodrigues
* Kamil Monicz
* okhowang(王沛文)
* Alex G. Wolff
* Ben Harris
* Guthrie McAfee Armstrong
* Jonathan A. Sternberg
* KR Ravindra
* MohammadHasan Akbari
* MsfPablo
* Paul Schroeder
* Ruzan Sasuri
* Sterling Greene
* Suhail Hany
* ZRHann


### Notable changes

- Built-in Dockerfile frontend has been updated to v1.28.0 [changelog](https://github.com/moby/buildkit/releases/tag/dockerfile%2F1.28.0)
- BoltDB databases now support compaction to periodically reduce database size and compress them on disk. This feature is currently opt-in and can be enabled with TOML configuration. The intention is to enable it by default in future releases. #7138 #7248
- Local and tar exporters now support the `src` option for specifying the subdirectory to export. #7226
- Provenance attestation now contains information about the target platform of the build. #7227
- Unpack exporter option is not supported in rewrite-timestamp mode. #6939
- Reduce BoltDB database size and performance overhead #6882
- Transient registry token failures are now retried. #7155
- Add protection to using concurrent local cache exports with `reset` option. #7153
- NewContainer API in Gateway now preserves the platform information of the created container. #7083
- Enable configuring Hyper-V isolation mode for Windows containers. #7067
- S3 remote cache backend now supports compression options. #7121
- Session authentication timeout is now configurable from TOML configuration. #7225
- Startup performance of internal databases has been improved by creating a BoltDB freelist on graceful shutdown #7249
- Improve recovery from database open failures in more internal databases. #7137
- Buildkitd now supports defining the configuration path with an environment variable. #7144
- Original messages from GitHub cache backend are now preserved. #7232
- Avoid panic from misconfigured GC policy. #7209
- Fix issue where some cache records could remain in use after build completion with an error. #7223
- Fix possible cache export failure with parallel requests. #7145
- Fix incorrect backslash escaping in RUN step progress output. #7188
- Fix encoding of some material URLs with custom ports in the provenance attestation. #5641
- Fix possible "ref locked: unavailable" errors on parallel builds export step. #7182
- Fix possible build errors when using `SOURCE_DATE_EPOCH` together with subdir Git sources. #7183
- Fix possible EBUSY errors from overlay filesystem on some systems. #7167
- Fix bug that could cause some internal database indexes to never get released. #7135
- Fix handling of IPv6 hosts without an explicit port. #7164
- Fix possible build error when canceling QEMU emulated build step. #7092
- Fix using normalized variant of platform identifier in annotation key #7244
- Fix possible storage reference leak when canceling build in the middle of exec step #7247
- Fix possible deadlock on large bidirectional stdio streams #7240
- Fix possible hang on container output writer error #7243


### Dependency Changes

* **github.com/aws/aws-sdk-go-v2**                                                  v1.43.8 -> v1.47.0
* **github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream**                         v1.7.18 -> v1.7.20
* **github.com/aws/aws-sdk-go-v2/config**                                           v1.32.39 -> v1.33.4
* **github.com/aws/aws-sdk-go-v2/credentials**                                      v1.19.38 -> v1.20.4
* **github.com/aws/aws-sdk-go-v2/feature/ec2/imds**                                 v1.18.39 -> v1.20.0
* **github.com/aws/aws-sdk-go-v2/internal/configsources**                           v1.4.39 -> v1.5.3
* **github.com/aws/aws-sdk-go-v2/internal/endpoints/v2**                            v2.7.39 -> v2.8.3
* **github.com/aws/aws-sdk-go-v2/internal/v4a**                                     v1.4.40 -> v1.5.3
* **github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding**                 v1.13.18 -> v1.13.19
* **github.com/aws/aws-sdk-go-v2/service/internal/presigned-url**                   v1.13.39 -> v1.14.3
* **github.com/aws/aws-sdk-go-v2/service/signin**                                   v1.5.8 -> v1.10.0
* **github.com/aws/aws-sdk-go-v2/service/sso**                                      v1.33.8 -> v1.38.0
* **github.com/aws/aws-sdk-go-v2/service/ssooidc**                                  v1.38.8 -> v1.43.0
* **github.com/aws/aws-sdk-go-v2/service/sts**                                      v1.45.8 -> v1.50.0
* **github.com/aws/smithy-go**                                                      v1.27.10 -> v1.28.2
* **github.com/containerd/containerd/api**                                          v1.11.1 -> v1.12.0
* **github.com/containerd/containerd/v2**                                           v2.3.6 -> v2.4.1
* **github.com/containerd/go-cni**                                                  v1.1.13 -> v1.1.14
* **github.com/containerd/log/otel**                                                v0.1.0 **_new_**
* **github.com/containerd/ttrpc**                                                   v1.2.9 -> v1.2.10
* **github.com/containernetworking/cni**                                            v1.3.0 -> v1.3.1
* **github.com/cyphar/filepath-securejoin**                                         v0.6.1 -> v0.7.0
* **github.com/docker/cli**                                                         v29.7.2 -> v29.8.2
* **github.com/docker/docker-credential-helpers**                                   v0.9.8 -> v0.9.9
* **github.com/docker/go-metrics**                                                  v0.0.1 -> v0.1.0
* **github.com/fsnotify/fsnotify**                                                  v1.9.0 -> v1.10.1
* **github.com/go-openapi/analysis**                                                v0.25.2 -> v0.25.5
* **github.com/go-openapi/jsonpointer**                                             v0.23.1 -> v1.0.0
* **github.com/go-openapi/jsonreference**                                           v0.21.6 -> v1.0.0
* **github.com/go-openapi/loads**                                                   v0.24.0 -> v0.25.0
* **github.com/go-openapi/runtime**                                                 v0.32.4 -> v0.33.0
* **github.com/go-openapi/spec**                                                    v0.22.6 -> v0.22.9
* **github.com/go-openapi/strfmt**                                                  v0.26.4 -> v0.27.0
* **github.com/go-openapi/swag**                                                    v0.26.1 -> v0.28.0
* **github.com/go-openapi/swag/cmdutils**                                           v0.26.1 -> v0.28.0
* **github.com/go-openapi/swag/conv**                                               v0.27.0 -> v0.28.0
* **github.com/go-openapi/swag/fileutils**                                          v0.26.1 -> v0.28.0
* **github.com/go-openapi/swag/jsonutils**                                          v0.26.1 -> v0.28.0
* **github.com/go-openapi/swag/loading**                                            v0.26.1 -> v0.28.0
* **github.com/go-openapi/swag/mangling**                                           v0.26.1 -> v0.28.0
* **github.com/go-openapi/swag/netutils**                                           v0.26.1 -> v0.28.0
* **github.com/go-openapi/swag/pools**                                              v0.28.0 **_new_**
* **github.com/go-openapi/swag/stringutils**                                        v0.26.1 -> v0.28.0
* **github.com/go-openapi/swag/typeutils**                                          v0.27.0 -> v0.28.0
* **github.com/go-openapi/swag/yamlutils**                                          v0.26.1 -> v0.28.0
* **github.com/go-openapi/validate**                                                v0.26.0 -> v0.26.1
* **github.com/gofrs/flock**                                                        v0.13.0 -> v0.13.1
* **github.com/grpc-ecosystem/grpc-gateway/v2**                                     v2.29.0 -> v2.30.0
* **github.com/klauspost/compress**                                                 v1.19.2 -> v1.20.1
* **github.com/moby/policy-helpers**                                                dd6c5499c491 -> bd98f4747414
* **github.com/moby/profiles/seccomp**                                              v0.2.3 -> v0.2.4
* **github.com/moby/sys/userns**                                                    v0.2.0 -> v0.2.1
* **github.com/package-url/packageurl-go**                                          v0.1.1 -> v0.1.7
* **github.com/prometheus/client_model**                                            v0.6.2 -> v0.6.3
* **github.com/prometheus/common**                                                  v0.70.1 -> v0.71.0
* **github.com/sirupsen/logrus**                                                    v1.10.1 -> v1.10.2
* **github.com/tonistiigi/go-actions-cache**                                        54bc28c26fd2 -> afe8013b5ac4
* **github.com/urfave/cli/v3**                                                      v3.9.0 -> v3.11.0
* **go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc**   v0.70.0 -> v0.71.0
* **go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace**  v0.70.0 -> v0.71.0
* **go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp**                 v0.70.0 -> v0.71.0
* **go.opentelemetry.io/otel**                                                      v1.45.0 -> v1.46.0
* **go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc**             v1.45.0 -> v1.46.0
* **go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp**             v1.45.0 -> v1.46.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace**                             v1.45.0 -> v1.46.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc**               v1.45.0 -> v1.46.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp**               v1.45.0 -> v1.46.0
* **go.opentelemetry.io/otel/exporters/prometheus**                                 v0.67.0 -> v0.68.0
* **go.opentelemetry.io/otel/metric**                                               v1.45.0 -> v1.46.0
* **go.opentelemetry.io/otel/sdk**                                                  v1.45.0 -> v1.46.0
* **go.opentelemetry.io/otel/sdk/metric**                                           v1.45.0 -> v1.46.0
* **go.opentelemetry.io/otel/trace**                                                v1.45.0 -> v1.46.0
* **google.golang.org/genproto/googleapis/api**                                     6ac0973c030d -> da73d73af1c5
* **google.golang.org/genproto/googleapis/rpc**                                     6ac0973c030d -> da73d73af1c5
* **google.golang.org/grpc**                                                        v1.83.2 -> v1.84.0
* **tags.cncf.io/container-device-interface**                                       v1.1.0 -> v1.1.1
* **tags.cncf.io/container-device-interface/specs-go**                              v1.1.0 -> v1.1.1

Previous release can be found at [v0.33.1](https://github.com/moby/buildkit/releases/tag/v0.33.1)

buildkit 0.34.0-rc2

Welcome to the v0.34.0-rc2 release of buildkit!  
*This is a pre-release of buildkit*



Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

### Contributors

* Tõnis Tiigi
* CrazyMax
* Sebastiaan van Stijn
* Kamil Monicz
* Ruzan Sasuri

### Notable Changes

- Startup performance of internal databases has been improved by creating a BoltDB freelist on graceful shutdown #7249
- Database compaction now supports configuring minimum reclaimable percentage to avoid unnecessary compaction on very big databases #7248
- Fix using normalized variant of platform identifier in annotation key #7244
- Fix possible storage reference leak when canceling build in the middle of exec step #7247
- Fix possible deadlock on large bidirectional stdio streams #7240
- Fix possible hang on container output writer error #7243


### Dependency Changes

* **github.com/docker/cli**           v29.8.1 -> v29.8.2
* **github.com/moby/policy-helpers**  72f704e6cdb6 -> bd98f4747414

Previous release can be found at [v0.34.0-rc1](https://github.com/moby/buildkit/releases/tag/v0.34.0-rc1)

buildkit 0.34.0-rc1

Welcome to the v0.34.0-rc1 release of buildkit!  
*This is a pre-release of buildkit*



Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

### Contributors

* Tõnis Tiigi
* CrazyMax
* Sebastiaan van Stijn
* Akihiro Suda
* Ernestas Lukoševičius
* Alexandre Rodrigues
* okhowang(王沛文)
* Alex G. Wolff
* Ben Harris
* Guthrie McAfee Armstrong
* Jonathan A. Sternberg
* KR Ravindra
* MohammadHasan Akbari
* MsfPablo
* Paul Schroeder
* Sterling Greene
* Suhail Hany
* ZRHann

### Notable changes

- Built-in Dockerfile frontend has been updated to v1.28.0-rc1 [changelog](https://github.com/moby/buildkit/releases/tag/dockerfile%2F1.28.0-rc1)
- BoltDB databases now support compaction to periodically reduce database size and compress them on disk. This feature is currently opt-in and can be enabled with TOML configuration. The intention is to enable it by default in future releases. #7138
- Local and tar exporters now support the `src` option for specifying the subdirectory to export. #7226
- Provenance attestation now contains information about the target platform of the build. #7227
- Unpack exporter option is not supported in rewrite-timestamp mode. #6939
- Reduce BoltDB database size and performance overhead #6882
- Transient registry token failures are now retried. #7155
- Add protection to using concurrent local cache exports with `reset` option. #7153
- NewContainer API in Gateway now preserves the platform information of the created container. #7083
- Enable configuring Hyper-V isolation mode for Windows containers. #7067
- S3 remote cache backend now supports compression options. #7121
- Session authentication timeout is now configurable from TOML configuration. #7225
- Improve recovery from database open failures in more internal databases. #7137
- Buildkitd now supports defining the configuration path with an environment variable. #7144
- Original messages from GitHub cache backend are now preserved. #7232
- Avoid panic from misconfigured GC policy. #7209
- Fix issue where some cache records could remain in use after build completion with an error. #7223
- Fix possible cache export failure with parallel requests. #7145
- Fix incorrect backslash escaping in RUN step progress output. #7188
- Fix encoding of some material URLs with custom ports in the provenance attestation. #5641
- Fix possible "ref locked: unavailable" errors on parallel builds export step. #7182
- Fix possible build errors when using `SOURCE_DATE_EPOCH` together with subdir Git sources. #7183
- Fix possible EBUSY errors from overlay filesystem on some systems. #7167
- Fix bug that could cause some internal database indexes to never get released. #7135
- Fix handling of IPv6 hosts without an explicit port. #7164
- Fix possible build error when canceling QEMU emulated build step. #7092


### Dependency Changes

* **github.com/aws/aws-sdk-go-v2**                                                  v1.43.8 -> v1.47.0
* **github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream**                         v1.7.18 -> v1.7.20
* **github.com/aws/aws-sdk-go-v2/config**                                           v1.32.39 -> v1.33.4
* **github.com/aws/aws-sdk-go-v2/credentials**                                      v1.19.38 -> v1.20.4
* **github.com/aws/aws-sdk-go-v2/feature/ec2/imds**                                 v1.18.39 -> v1.20.0
* **github.com/aws/aws-sdk-go-v2/internal/configsources**                           v1.4.39 -> v1.5.3
* **github.com/aws/aws-sdk-go-v2/internal/endpoints/v2**                            v2.7.39 -> v2.8.3
* **github.com/aws/aws-sdk-go-v2/internal/v4a**                                     v1.4.40 -> v1.5.3
* **github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding**                 v1.13.18 -> v1.13.19
* **github.com/aws/aws-sdk-go-v2/service/internal/presigned-url**                   v1.13.39 -> v1.14.3
* **github.com/aws/aws-sdk-go-v2/service/signin**                                   v1.5.8 -> v1.10.0
* **github.com/aws/aws-sdk-go-v2/service/sso**                                      v1.33.8 -> v1.38.0
* **github.com/aws/aws-sdk-go-v2/service/ssooidc**                                  v1.38.8 -> v1.43.0
* **github.com/aws/aws-sdk-go-v2/service/sts**                                      v1.45.8 -> v1.50.0
* **github.com/aws/smithy-go**                                                      v1.27.10 -> v1.28.2
* **github.com/containerd/containerd/api**                                          v1.11.1 -> v1.12.0
* **github.com/containerd/containerd/v2**                                           v2.3.6 -> v2.4.1
* **github.com/containerd/go-cni**                                                  v1.1.13 -> v1.1.14
* **github.com/containerd/log/otel**                                                v0.1.0 **_new_**
* **github.com/containerd/ttrpc**                                                   v1.2.9 -> v1.2.10
* **github.com/containernetworking/cni**                                            v1.3.0 -> v1.3.1
* **github.com/cyphar/filepath-securejoin**                                         v0.6.1 -> v0.7.0
* **github.com/docker/cli**                                                         v29.7.2 -> v29.8.1
* **github.com/docker/docker-credential-helpers**                                   v0.9.8 -> v0.9.9
* **github.com/docker/go-metrics**                                                  v0.0.1 -> v0.1.0
* **github.com/fsnotify/fsnotify**                                                  v1.9.0 -> v1.10.1
* **github.com/go-openapi/analysis**                                                v0.25.2 -> v0.25.5
* **github.com/go-openapi/jsonpointer**                                             v0.23.1 -> v1.0.0
* **github.com/go-openapi/jsonreference**                                           v0.21.6 -> v1.0.0
* **github.com/go-openapi/loads**                                                   v0.24.0 -> v0.25.0
* **github.com/go-openapi/runtime**                                                 v0.32.4 -> v0.33.0
* **github.com/go-openapi/spec**                                                    v0.22.6 -> v0.22.9
* **github.com/go-openapi/strfmt**                                                  v0.26.4 -> v0.27.0
* **github.com/go-openapi/swag**                                                    v0.26.1 -> v0.28.0
* **github.com/go-openapi/swag/cmdutils**                                           v0.26.1 -> v0.28.0
* **github.com/go-openapi/swag/conv**                                               v0.27.0 -> v0.28.0
* **github.com/go-openapi/swag/fileutils**                                          v0.26.1 -> v0.28.0
* **github.com/go-openapi/swag/jsonutils**                                          v0.26.1 -> v0.28.0
* **github.com/go-openapi/swag/loading**                                            v0.26.1 -> v0.28.0
* **github.com/go-openapi/swag/mangling**                                           v0.26.1 -> v0.28.0
* **github.com/go-openapi/swag/netutils**                                           v0.26.1 -> v0.28.0
* **github.com/go-openapi/swag/pools**                                              v0.28.0 **_new_**
* **github.com/go-openapi/swag/stringutils**                                        v0.26.1 -> v0.28.0
* **github.com/go-openapi/swag/typeutils**                                          v0.27.0 -> v0.28.0
* **github.com/go-openapi/swag/yamlutils**                                          v0.26.1 -> v0.28.0
* **github.com/go-openapi/validate**                                                v0.26.0 -> v0.26.1
* **github.com/gofrs/flock**                                                        v0.13.0 -> v0.13.1
* **github.com/grpc-ecosystem/grpc-gateway/v2**                                     v2.29.0 -> v2.30.0
* **github.com/klauspost/compress**                                                 v1.19.2 -> v1.20.1
* **github.com/moby/policy-helpers**                                                dd6c5499c491 -> 72f704e6cdb6
* **github.com/moby/profiles/seccomp**                                              v0.2.3 -> v0.2.4
* **github.com/moby/sys/userns**                                                    v0.2.0 -> v0.2.1
* **github.com/package-url/packageurl-go**                                          v0.1.1 -> v0.1.7
* **github.com/prometheus/client_model**                                            v0.6.2 -> v0.6.3
* **github.com/prometheus/common**                                                  v0.70.1 -> v0.71.0
* **github.com/sirupsen/logrus**                                                    v1.10.1 -> v1.10.2
* **github.com/tonistiigi/go-actions-cache**                                        54bc28c26fd2 -> afe8013b5ac4
* **github.com/urfave/cli/v3**                                                      v3.9.0 -> v3.11.0
* **go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc**   v0.70.0 -> v0.71.0
* **go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace**  v0.70.0 -> v0.71.0
* **go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp**                 v0.70.0 -> v0.71.0
* **go.opentelemetry.io/otel**                                                      v1.45.0 -> v1.46.0
* **go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc**             v1.45.0 -> v1.46.0
* **go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp**             v1.45.0 -> v1.46.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace**                             v1.45.0 -> v1.46.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc**               v1.45.0 -> v1.46.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp**               v1.45.0 -> v1.46.0
* **go.opentelemetry.io/otel/exporters/prometheus**                                 v0.67.0 -> v0.68.0
* **go.opentelemetry.io/otel/metric**                                               v1.45.0 -> v1.46.0
* **go.opentelemetry.io/otel/sdk**                                                  v1.45.0 -> v1.46.0
* **go.opentelemetry.io/otel/sdk/metric**                                           v1.45.0 -> v1.46.0
* **go.opentelemetry.io/otel/trace**                                                v1.45.0 -> v1.46.0
* **google.golang.org/genproto/googleapis/api**                                     6ac0973c030d -> da73d73af1c5
* **google.golang.org/genproto/googleapis/rpc**                                     6ac0973c030d -> da73d73af1c5
* **google.golang.org/grpc**                                                        v1.83.2 -> v1.84.0
* **tags.cncf.io/container-device-interface**                                       v1.1.0 -> v1.1.1
* **tags.cncf.io/container-device-interface/specs-go**                              v1.1.0 -> v1.1.1

Previous release can be found at [v0.33.1](https://github.com/moby/buildkit/releases/tag/v0.33.1)

Welcome to the v0.33.1 release of buildkit!



Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

### Contributors

* Tõnis Tiigi
* CrazyMax
* Sebastiaan van Stijn

### Notable Changes

- Built-in Dockerfile frontend has been updated to v1.27.1 [changelog](https://github.com/moby/buildkit/releases/tag/dockerfile%2F1.27.1).
- Fix proxy CA cleanup so build steps cannot redirect it outside the build rootfs, block it with a special file, or succeed when cleanup fails. GHSA-2f5p-x9ph-g97x
- Fix a daemon panic when a build requests CDI devices while CDI support is disabled. Optional devices are ignored; required devices produce an error. GHSA-r456-g3gm-cvxf
- Verify container blob contents against their claimed digest before caching them. This protects shared caches from unverified blobs supplied through the low-level LLB API. GHSA-p3rc-w3hc-pqvv
- Verify applied image layer DiffIDs, bind lazy stargz snapshots to their verified TOC digest, and isolate legacy layer snapshots. Image source cache keys no longer rely on unverified DiffIDs. GHSA-f2v9-hprr-32q3
- Prevent malicious external frontends from crashing the daemon through gateway container lifecycle races or malformed requests and definitions. GHSA-4hgw-qrhw-fhg8
- Reject special files in daemon-side snapshot reads and replace existing special files safely in LLB `mkfile` operations. GHSA-9728-qjrv-2xh2
- Reject malformed LLB file operations with invalid symlink owner inputs instead of allowing a daemon panic. GHSA-fjj4-h6vf-m9hj
- Reject malformed LLB merge operations with mismatched input counts instead of allowing a daemon panic. GHSA-cv6p-7w7g-xjwq
- Limit Dockerfile, `.dockerignore`, gateway file, and nested LLB definition reads to prevent oversized inputs from exhausting daemon memory. GHSA-mgqf-486f-49vp
- Apply source policies to Git bundle locators and reject Git full remote URLs that do not match the source identifier. GHSA-66hf-6vf5-87hc

### Dependency Changes

* **github.com/containerd/containerd/v2**  v2.3.4 -> v2.3.6
* **golang.org/x/crypto**                  v0.55.0 -> v0.56.0

Previous release can be found at [v0.33.0](https://github.com/moby/buildkit/releases/tag/v0.33.0)

Welcome to the v0.33.0 release of buildkit!



Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

### Contributors

* CrazyMax
* Tõnis Tiigi
* Sebastiaan van Stijn
* Matthieu MOREL
* eliuriegas
* Daniel Nephin
* Dawei Wei
* Guthrie McAfee Armstrong
* Jiří Moravčík
* Leo Li
* Ravi Arnan
* Shurong Cao
* Spencer G. Jones
* Vedant Madane

### Notable Changes

- Built-in Dockerfile frontend has been updated to v1.27.0 [changelog](https://github.com/moby/buildkit/releases/tag/dockerfile%2F1.27.0)
- Builds using proxy-based network tracking/monitoring for exec steps now support fallback to the daemon's proxy settings when the BuildKit daemon is running behind a proxy. #7074
- The maximum attestation size for exporters has been raised to 80 MiB. #7104
- Content produced by Rootless versions of BuildKit has been updated to be compatible with Rootful versions of BuildKit for result reproducibility. #7039
- Buildctl now supports passing valueless build-args read from the environment. #7030
- Sanitize platform IDs returned by frontend to ensure tar exports can't end up with invalid paths for Windows. #7022
- Suppress bogus git advice messages on progress output from the way BuildKit checks out git repositories. #6998
- Build history can now be disabled from daemon configuration #7040
- Redact more possible inline credentials in progress output or HTTP source and Git bundle steps. This didn't include builds that used build secrets to pass credentials. #7068
- MaxRegistryConcurrency now also applies to remote cache requests. #7049
- Windows containers now support `RUN --mount=type=secret` build secrets. #6944
- Fix possible "no active session for" error when running concurrent builds with remote cache #7047
- Fix possible "failed to apply diffs: snapshot does not exist" error #7035
- Fix possible context upload errors when context directory contains foreign characters. #6989
- Fix possible silently dropped cache link in remote cache exporter. #7053
- Fix xz archive unpacking silently skipping when xz binary was missing in environment. #7071
- Fix possible incorrect platform validation warnings caused by mismatched Windows OS versions #7072
- Fix QEMU emulator arguments being persisted on an exec operation when a canceled operation is executed again. #7092


### Dependency Changes

* **cyphar.com/go-pathrs**                                                          v0.2.1 -> v0.2.5
* **github.com/Microsoft/hcsshim**                                                  v0.15.0-rc.1 -> v0.15.0-rc.4
* **github.com/aws/aws-sdk-go-v2**                                                  v1.43.0 -> v1.43.8
* **github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream**                         v1.7.14 -> v1.7.18
* **github.com/aws/aws-sdk-go-v2/config**                                           v1.32.31 -> v1.32.39
* **github.com/aws/aws-sdk-go-v2/credentials**                                      v1.19.30 -> v1.19.38
* **github.com/aws/aws-sdk-go-v2/feature/ec2/imds**                                 v1.18.31 -> v1.18.39
* **github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager**                       v0.3.5 -> v0.3.10
* **github.com/aws/aws-sdk-go-v2/internal/configsources**                           v1.4.31 -> v1.4.39
* **github.com/aws/aws-sdk-go-v2/internal/endpoints/v2**                            v2.7.31 -> v2.7.39
* **github.com/aws/aws-sdk-go-v2/internal/v4a**                                     v1.4.32 -> v1.4.40
* **github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding**                 v1.13.13 -> v1.13.18
* **github.com/aws/aws-sdk-go-v2/service/internal/checksum**                        v1.9.24 -> v1.9.28
* **github.com/aws/aws-sdk-go-v2/service/internal/presigned-url**                   v1.13.31 -> v1.13.39
* **github.com/aws/aws-sdk-go-v2/service/internal/s3shared**                        v1.19.32 -> v1.19.36
* **github.com/aws/aws-sdk-go-v2/service/s3**                                       v1.106.0 -> v1.106.5
* **github.com/aws/aws-sdk-go-v2/service/signin**                                   v1.5.0 -> v1.5.8
* **github.com/aws/aws-sdk-go-v2/service/sso**                                      v1.33.0 -> v1.33.8
* **github.com/aws/aws-sdk-go-v2/service/ssooidc**                                  v1.38.0 -> v1.38.8
* **github.com/aws/aws-sdk-go-v2/service/sts**                                      v1.45.0 -> v1.45.8
* **github.com/aws/smithy-go**                                                      v1.27.4 -> v1.27.10
* **github.com/containerd/containerd/v2**                                           v2.3.3 -> v2.3.4
* **github.com/containerd/go-runc**                                                 v1.1.0 -> v1.2.1
* **github.com/containerd/platforms**                                               v1.0.0-rc.4 -> v1.0.0-rc.5
* **github.com/cyphar/filepath-securejoin**                                         v0.6.0 -> v0.6.1
* **github.com/docker/cli**                                                         v29.6.2 -> v29.7.2
* **github.com/felixge/httpsnoop**                                                  v1.0.4 -> v1.1.0
* **github.com/go-logr/logr**                                                       v1.4.3 -> v1.4.4
* **github.com/klauspost/compress**                                                 v1.19.1 -> v1.19.2
* **github.com/moby/policy-helpers**                                                856be88baec4 -> dd6c5499c491
* **github.com/moby/sys/userns**                                                    v0.1.0 -> v0.2.0
* **github.com/pelletier/go-toml/v2**                                               v2.3.1 -> v2.4.3
* **github.com/prometheus/client_golang**                                           v1.23.2 -> v1.24.1
* **github.com/prometheus/common**                                                  v0.67.5 -> v0.70.1
* **github.com/prometheus/procfs**                                                  v0.20.1 -> v0.21.1
* **github.com/sirupsen/logrus**                                                    v1.9.4 -> v1.10.1
* **github.com/stretchr/testify**                                                   v1.11.1 -> v1.12.1
* **github.com/tonistiigi/fsutil**                                                  6d9dc2ebad62 -> 83cac42c1c52
* **go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc**   v0.69.0 -> v0.70.0
* **go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace**  v0.69.0 -> v0.70.0
* **go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp**                 v0.69.0 -> v0.70.0
* **go.opentelemetry.io/otel**                                                      v1.44.0 -> v1.45.0
* **go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc**             v1.44.0 -> v1.45.0
* **go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp**             v1.44.0 -> v1.45.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace**                             v1.44.0 -> v1.45.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc**               v1.44.0 -> v1.45.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp**               v1.44.0 -> v1.45.0
* **go.opentelemetry.io/otel/exporters/prometheus**                                 v0.66.0 -> v0.67.0
* **go.opentelemetry.io/otel/metric**                                               v1.44.0 -> v1.45.0
* **go.opentelemetry.io/otel/sdk**                                                  v1.44.0 -> v1.45.0
* **go.opentelemetry.io/otel/sdk/metric**                                           v1.44.0 -> v1.45.0
* **go.opentelemetry.io/otel/trace**                                                v1.44.0 -> v1.45.0
* **go.opentelemetry.io/proto/otlp**                                                v1.10.0 -> v1.11.0
* **go.yaml.in/yaml/v3**                                                            v3.0.4 -> v3.0.5
* **golang.org/x/crypto**                                                           v0.54.0 -> v0.55.0
* **golang.org/x/mod**                                                              v0.38.0 -> v0.40.0
* **golang.org/x/net**                                                              v0.57.0 -> v0.58.0
* **golang.org/x/text**                                                             v0.40.0 -> v0.41.0
* **google.golang.org/genproto/googleapis/api**                                     3dc84a4a5aaa -> 6ac0973c030d
* **google.golang.org/genproto/googleapis/rpc**                                     3dc84a4a5aaa -> 6ac0973c030d
* **google.golang.org/grpc**                                                        v1.82.1 -> v1.83.2
* **google.golang.org/grpc/cmd/protoc-gen-go-grpc**                                 v1.6.1 -> v1.6.2
* **google.golang.org/protobuf**                                                    f2248ac996af -> v1.36.12

Previous release can be found at [v0.32.2](https://github.com/moby/buildkit/releases/tag/v0.32.2)